Detection and/or interdiction (e.g. prevention of execution, downloading, opening or the like or restriction of access rights to unsecured parts of an execution or computing environment such as the main memory, local or networked storage, the operating system, etc.) of potentially dangerous code objects, such as malware, viruses, and other unwanted or untrusted objects, executables, etc., in a software execution environment (e.g. a computer, a server, a mobile device, etc.) may be performed as part of cybersecurity and threat detection, prevention, and/or evaluation strategies. For example, actions performed by or events relating to a computer may be recorded and/or analyzed to provide visibility into factors affecting safe execution, downloads, etc. as well as for characterizing the performance of applications running on a computer, etc.
Retention of data characterizing a history of the operating environment of an endpoint computer (e.g. a desktop or laptop computer, a mobile device such as a phone or a tablet computer, or any other kind of computer device that executes software) including, but not limited to the time preceding and/or during a threat, an attack, a period of less than optimal execution performance, or any other time during which data about events occurring within or relating to the computing environment of the endpoint computer, can be useful in diagnosing one or more of a source, a responsible party, a magnitude of a potential threat, a etc. of malicious code and/or other forms of threats or cyber attacks and can also assist in improving the effectiveness of detection and prevention efforts in addition to providing a record that can be useful in identifying and/or repairing those software components and/or data affected by a threat. Furthermore, retention of such data can be useful in supporting investigations into any type of potentially interesting event or sequence of events on or concerning the endpoint computer, not necessarily limited to threats or malicious code.
Efforts to retain such data can be an important part of computer forensics, which can include processes of examining a system to find malicious code and/or remnants of a malicious attack or other surreptitious activity (e.g. threads, processes, executable files, or the like) that perform unwanted or otherwise damaging operations that may affect a computer, a group of computers, a network, etc.